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Abstract 

We study the simultaneous message passing model of communication complexity. Building 
on the quantum fingerprinting protocol of Buhrman et al., Yao recently showed that a large 
class of efficient classical public-coin protocols can be turned into efficient quantum protocols 
without public coin. This raises the question whether this can be done always, i.e. whether 
quantum communication can always replace a public coin in the SMP model. We answer this 
question in the negative, exhibiting a communication problem where classical communication 
with public coin is exponentially more efficient than quantum communication. Together with 
a separation in the other direction due to Bar-Yossef et al., this shows that the quantum SMP 
model is incomparable with the classical public-coin SMP model. 

In addition we give a characterization of the power of quantum fingerprinting by means of 
a connection to geometrical tools from machine learning, a quadratic improvement of Yao's 
simulation, and a nearly tight analysis of the Hamming distance problem from Yao's paper. 

1 Introduction 

1.1 Setting 

The area of communication complexity deals with the amount of communication required for solving 
computational problems with distributed input. This area is interesting in its own right, but also 
has many applications to lower bounds on circuit size, data structures, etc. The simultaneous 
message passing (SMP) model involves three parties: Alice, Bob, and a referee. Alice gets input x, 
Bob gets input y. They each send one message to the referee, to enable him to compute something 
depending on both x and y, such as a Boolean function or some relational property. The cost or 
complexity of a communication protocol is the length of the total communication for a worst-case 
input, and the complexity of a problem is the cost of the best protocol. 

The SMP model is arguably the weakest setting of communication complexity that is still 
interesting. Even this simple setting is not well understood. In the case of deterministic protocols, 
the optimal communication is determined by the number of distinct rows (and columns) in the 
communication matrix, which is a simple property. However, as soon as we add randomization 
to the model things become much more complicated. For one, we can choose to either add public 
or private coin flips. In more general communication models this difference affects the optimal 
communication by at most an additive O(logn) ^ni; but in the SMP model the difference can be 
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huge. For example, the equahty function for n-bit strings requires about \/n bits of communication 
if the parties have only a private coin P1 l2()| [^. but only constant communication with a public coin! 
No simple characterization of public-coin or private-coin communication complexity is known. ^ 

The situation becomes more complicated still when we throw in quantum communication. 
Buhrman et al. jH] exhibited a no-coin quantum protocol for the equality function with O(logn) 
qubits of communication. This is exponentially better than classical private-coin protocols, but 
slightly worse than public-coin protocols. Roughly speaking, their quantum fingerprinting tech- 
nique may be viewed as replacing the shared randomness by a quantum superposition. This idea 
was generalized by Yao j23j . who showed that every public-coin protocol with c-bit messages for 
a Boolean function can be simulated by a quantum fingerprinting protocol that uses 0(2^'^ log n) 
qubits of communication. In particular, every 0(l)-bit public-coin protocol can be simulated by 
an 0(log n)-qubit quantum protocol without public coin. Again, quantum superposition essentially 
replaces shared randomness in his construction. 

1.2 Our results 

This raises the question whether something similar always holds in the SMP model: can every 
efficient classical public-coin protocol be efficiently simulated by some quantum protocol without 
public coin? (Here we do not allow the quantum Alice and Bob to start with an entangled state, 
since this could simulate a public coin for free.) Since the appearance of Yao's paper, quite a 
number of people have tried to address this. Our main result is a negative answer to this question. 
Suppose Alice receives input x G {0, l}*^ and Bob receives y,s G {0, l}*^ with the property that s 
has Hamming weight n/2. The referee is required to output a triple {i,Xi,yi) for an i satisfying 
Si = 1, but he is also allowed to output "don't know" with some small probability e. We prove 
that public-coin protocols can solve this task with O(logn) bits of communication, while every 
quantum protocol needs f^{^/n) qubits of communication. This shows for the first time that the 
resource of public coin flips cannot efficiently be traded for quantum communication. Our proof of 
the quantum lower bound may be of wider interest for the way it treats the independence of Alice's 
and Bob's messages. 

Yao's exponential simulation can be made to work for relations as well, and our quantum 
lower bound shows that it is essentially optimal, since the required quantum communication is 
exponentially larger than the classical public-coin complexity for our relational problem. We expect 
a similar gap to hold for (promise) Boolean functions as well. In SectionEJwe describe a function for 
which we conjecture an exponential gap. So far, we have not been able to prove this. Our separation 
complements a separation in the other direction: Bar-Yossef et al. [HI exhibited a relational problem 
where quantum SMP protocols are exponentially more efficient than classical SMP protocols even 
with a public coin (also in their case it is open whether there is a similar gap for a Boolean function). 
Accordingly, the quantum SMP model is incomparable with the classical public-coin SMP model. 

In addition to our main result, we address some other open problems from Yao's paper. A 
quantum flngerprinting protocol is one based on estimating the inner product between a flngerprint 
of Alice's input and a flngerprint of Bob's input. Both the protocols of Buhrman et al. [S] and of 
Yao J23! are based on this technique. Our main result says that no quantum protocol can efficiently 
solve the above relational task, so in particular quantum fingerprinting protocols are not able to 

^Kremer et al. claimed a characterization of public-coin complexity as the largest of the two one-way commu- 
nication complexities, but Bar-Yossef et al. |1J Section 4] exhibited a function where their characterization fails. 
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do this. Still, quantum fingerprinting is the only technique we know to get interesting quantum 
protocols in the SMP model, and it makes sense to study this technique in detail. In Section we 
analyze the power of quantum fingerprinting, and tightly characterize it in terms of the optimal 
margin achievable by realizations of the computational problem via an arrangement of homogeneous 
halfspaces. The latter notion is well studied in machine learning. We also give a small improvement 
of Yao's simulation for Boolean functions in Sectional by shaving a factor of 2 from the exponent. 
A similar improvement has independently been observed by Chakrabarti and Regev [7| and by 
Golinsky and Sen ^2]. The latter also extend Yao's definition of convex width. Finally, we give 
nearly tight bounds on the quantum SMP complexity of the Hamming distance problem, which 
was the main application of Yao's simulation in his paper. 

2 Preliminaries 

Communication complexity, in particular the simultaneous message passing model discussed here, is 
very intuitive so we will not provide formal definitions. Instead we refer to Kushilevitz and Nisan J2j 
for classical communication complexity and to the surveys jl51 151 1^ for the quantum variant. We 
use Rs'^^^{P), qI(-P) to denote, respectively, the classical private-coin, classical public- 

coin, and quantum private-coin communication complexities with worst-case error probability e for 
a distributed problem P. When the subscript is omitted, we take e = 1/3. 

The essentials needed for this paper are quantum states and their measurement. First, an 
m-qubit pure state is a superposition |0) = X^^gjo i}™ c^zN) over all classical m-bit states. The 
a^'s are complex numbers called amplitudes, and lozP = 1- Hence a pure state |0) is a unit 
vector in . Its complex conjugate (a row vector with entries conjugated) is denoted The 
inner product between and {ip) = Ylz(^z\z) is the dot product (</)| • {ip) = {(l)\ip) = X^^a*/?^. 
The norm of a vector w is || f || = {v\v). Second, a mixed state p = ^iPi\4'-i){4>i\ corresponds to 
a probability distribution over pure states, where \(j)i) is given with probability pi. A A;-outcome 
positive operator- valued measurement (POVM) is given by k positive operators Ei, . . . ^E^ with the 
property that "^^^=1 = I- When this POVM is applied to a mixed stated p, the probability of the 
i-th outcome is given by the trace Tr{Eip). We refer to Nielsen and Chuang for more details. 

3 Exponential Separation for a Relation 

In this section we prove our main result: we separate classical public-coin SMP protocols from 
quantum protocols, by exhibiting a problem where the latter requires exponentially more commu- 
nication. Consider the following relational problem P: 

Input: Alice receives input x £ {0, 1}", Bob receives y,s G {0, 1}" with \s\ = n/2. 
Output: with probability > 1 — e output {i,Xi,yi) s.t. Sj = 1, otherwise "don't know". 

This problem is easy for public coin-protocols, rI'^^^{P) = 0(lognlog(l/e)): Alice and Bob just 
send (i, Xi) and (z, yi, Sj), respectively, to the referee for log(l/e) public random i's. With probability 
1 — e, Sj = 1 for at least one of those i's and the referee outputs the corresponding {i,Xi,yi). With 
probability e he doesn't see an i for which Si = 1, in which case he outputs "don't know". We 
assume here that the public coin is shared by Alice and Bob, not by the referee. If we also allow 
the referee to view the coin, the classical public-coin complexity drops to 0(log(l/e)). Below we 
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show that we cannot trade the pubhc coin for quantum communication: quantum SMP protocols 
need to communicate Q{^/n) qubits to solve this task. 

Consider a quantum protocol that solves P and where Alice and Bob each send m-qubit mes- 
sages. Let and f3ys denote Alice's and Bob's messages produced in response to the given x and 
(y,s), respectively. These may be mixed states, reflecting private randomness. 

Alice's message cannot predict many Xj's well. 

Dehne states Ojo = 2^ a^, "ji = ^;;3T 2^ and a = — 2_^ax = -aio + -an- 

Suppose we have a quantum measurement that does the following: given i, and either aio or an 
(each with probability 1/2), with probability it outputs Xi (either or 1), and with probability 
1 — Oj it outputs "don't know". We will use quantum information theory to show that most Oj's 
must be fairly small. The "average message" a carries at least Oj bits of information about Xj. By 
Holevo's theorem |13j . the m-qubit a cannot contain more than m bits of information, hence 

n 

aj < m. 

1=1 

By Markov's inequality, there exist n/2 i's satisfying < 2m/n. In what follows, fix s to the n-bit 
string corresponding to those n/2 i's. 

Bob's message cannot predict many yj's well. 
We similarly analyze Bob's average message Pys for our fixed s. Define /3jo and Pn as before. Let 
bi be the maximal probability with which we can output yi, given i and one of /?jo or Pn. Then 

n 

bi < m. 

1=1 

Predictions of Xi and yi are essentially independent. 

Now consider the referee. He does his measurement on the state Ox Pys, and with probability pi 
(probability taken over random x and y), outputs {i,Xi,yi), and with probability p-? < e he outputs 
"don't know". We now want to show that pi = 0{aibi). This follows from the next lemma, which 
has the flavor of a "direct product theorem" from computational complexity. 

Lemma 1 A zero-error measurement for mixed states oq and ai is a 3-outcome measurement that 
outputs or ? given oq, and outputs 1 or ? given ai. Its success probability is the probability 
that it outputs or 1 under a uniform distribution over oq and qi . Let a be the maximal success 
probability over all zero-error measurements for ao and ai (so 1 — a is the probability of output 
?). Define b similarly for mixed states (3q or f3i, and p for 5- outcome zero- error measurements for 
oiQ ® Po, ao (8) ai (gi Pq, and ai /3i. Then p < Aab. 

Proof. Define a^'^^ = max_A4 Pr [measurement outputs given ao], where is the set of zero-error 
measurements for ao and ai. Similarly define a^^\ Then it is easy to see that 

imax(a(0),a«) < a < ^(aW + a«). (1) 

We can similarly define b^^^ and b^^^ for the measurement on Pq or Pi, and p(^^\ p(^^) , p(^^) , p(^^) for 
the measurement on ao Pq, Pi, ai Pq, ai Pi. In particular 

+ P )■ (2) 
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Now we will show that 

pied) ^ q(c 

for c,d €z {0, 1}. Without loss of generality assume c = d = 0. 
Call Sq the support of ao (i.e. the span of the eigenstates with non-zero weight of ao); ■Sq its 
orthogonal complement, and similarly Tq and Tq- for Pq. Note that because the measurement has 
zero error the support of the measurement operators corresponding to output "0" have to be in 
Si - Clearly the measurement that maximizes a^^^ is the projection onto Si and a^^^ = Ti:{ao\g±). 

Similarly b^^^ = Tt{Po\^±)). To determine the measurement on ao Po that gives the maximum 

p(oo) note that each zero-error measurement to determine ao Po has to be in the intersection 
l={Sox Ti)^ n {Si X To)^ n {Si X Ti)^ . Expanding {So x Ti)^ = {S^ x T^^) © {So x T^^) © {S^ x Ti) 
and similarly for the other terms we obtain Z = 5^*" xT^-*", so the optimal measurement is a projection 
onX, giving = Tr[(ao©/5o)|(5Xxr^)] ~ Tr(ao|5±)Tr(/3o|'2-x) = a'^'^'>b^^\ The lemma now follows 
from dU and ©: p< \{a^^^b^^^ + a^^^^) + 0(^)6^0 + a^^^fe^i)) <\{4- 2a2b) = 4ab. □ 

Wrapping up the lower bound. 

Combining these building blocks gives m = 0,{y/n): 

1 — e < Pr [referee outputs {i,Xi,yi) for some i with Si = 1] 
Pi < >^ 4:a^b^ < — }^bi< . 

i:Si = l i:Si = l i=l 

A matching classical upper bound. 

This Sl(-\/n) bound is tight, witness the following classical private-coin protocol, inspired by 
Alice and Bob view n-bit strings as ^/n x y/n squares (we ignore rounding for simplicity). Alice 
sends the referee a randomly chosen row of x, with its column- index, at the cost of ^/n + log ^/n 
bits. Bob sends the referee a randomly chosen column of y, with its index, and the same column 
of s at the cost of 2y/n + log y/n bits. Alice's row and Bob's column intersect in exactly one point 
i G [n], so for one (uniformly random) i the referee now has i,Xi,yi,Si. With probability 1/2, Sj = 1 
and the referee is done. Repeating this log(l/e) times costs 0(y^log(l/e)) bits and has error < e. 
We summarize the exponential separation in our main theorem: 

Theorem 1 For the problem P we have B\\^p'''^{P) = e(logn) and RHp), QHp) = e(^). 

Remark: i?ll'f"^(P) = 17 (log n) follows from QII(P) = Q{^/n) and from the extension of Yao's 
exponential simulation to relations (as outlined at the end of Section inj. That simulation result is 
no longer true if the referee sees the shared random string, since R}^'P'^^{P) drops to constant then. 

4 Characterization of Quantum Fingerprinting 

As mentioned, all nontrivial and nonclassical quantum SMP protocols known are based on a tech- 
nique called quantum fingerprinting. Here we will analyze the power of protocols that employ this 
technique, and show that it is closely related to a well studied notion from computational learning 
theory. This addresses the 4th open problem Yao states in In particular, we will show that 
such quantum fingerprinting protocols cannot efficiently compute many Boolean functions for which 
there is an efficient classical public-coin protocol. 
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Consider quantum protocols where Alice sends a (7-qubit state \ax), Bob sends a g'-qubit state 
|/3y), and the referee does the 2-outcome "swap test" This test outputs with probability 

2 2 

They repeat this r times in parallel, and the referee determines his output based on the r bits 
that are the outcomes of his r swap tests. We will call such protocols "repeated fingerprinting 
protocols". The cost of the protocol is 2qr. For simplicity we assume all amplitudes are real. 
A quantum protocol of this form can only work efficiently if we can ensure that < 
whenever f{x,y) = and > 61 whenever f{x,y) = 1. Here 60 < 61 should be reasonably 

far apart, otherwise r would have to be too large to distinguish the two cases. A statistical argument 
shows that r = — 5o)^) is necessary and sufficient. We now define two geometrical concepts: 

Definition 1 Let f : D ^ {0, 1}, with D (1 X x Y , be a distributed, possibly partial, Boolean 
function. Consider an assignment of unit vectors Ux G M'^, Py G M*^ to all x ^ X and y Y. 

This assignment is called a (d, (5o, 5i)-threshold embedding of / if \ {ax\Py)\'^ < ^0 for all {x,y) S 
f-\0) and \{ax\Py)\^ > 61 for all {x,y) e /"^l). 

The assignment is called a d-dimensional realization of / with margin j > if {ax\Py) > 7 for 
all {x,y) G /"i(0) and {ax\[3y) < -7 for all {x,y) G f'^{l). 

Lemma 2 // there is a {d,5o, 61) -threshold embedding of f, then there is a (d^ + 1)- dimensional 
realization of f with margin 7 = (5i — So)/{2 + 61 + 60). 

Conversely, if there is a d-dimensional realization of f with margin 7, then there is a {d + 
1, 60, 61) -threshold embedding of f with 60 = {1 — 7)^/4 and 61 = (1 +7)^/4. 

Proof. Let Ox, I3y be the vectors in a {d, 5o, (5i)-threshold embedding of /. For a = {5i + 60) /(2 + 
5i + 5o), define new vectors a'^ = (-v/o, \/l — a ■ ax ax) and f3'y = {\/a, — a ■ (5y fiy). These 
are unit vectors of dimension d^ + 1. Now 

{a'x\P'y)=a-{l-a)\{ax\fiy)\^. 

If S /^-"^(l), then Ka^^l/Jy)]^ > 5i and hence {a'x\(i'y) < a — (1 — a)5i = —7. Similarly, 

(a'J/3p>7for {x,y)ef-\Q). 

For the converse, let ax,f3y be the vectors in a d-dimensional realization of / with margin 7. 
Define new (d + l)-dimensional unit vectors a'x = (1, ax)/V2 and P'y = (1, —l3y)/^/2. Now 

If G then {ax\(3y) < —7 and hence +7)^ = ^^i- A similar argument 

shows Kai|/3;)P< 1(1 -7)2 = Jo for (x,y)e/-i(0). ' □ 

Our notion of a "threshold embedding" is essentially Yao's [231 Section 6, question 4], except 
that we square the inner product instead of taking its absolute value, since it's the square that 
appears in the swap test's probability. Clearly, threshold embeddings and repeated fingerprinting 
protocols are essentially the same thing. The notion of a "realization" is computational learning 
theory's notion of the realization of a concept class by an arrangement of homogeneous halfspaces. 
The tradeoffs between dimension d and margin 7 have been well studied pi IIUI ITT] . In particular, 
we can invoke a bound on the best achievable margin of realizations due to Forster [H]: 
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Theorem 2 (Forster) For f : XxY {0,1}, define the \X\x\Y\-matrix M by M^y = (-l)-^(^'S') . 
Every realization of f (irrespective of its dimension) has margin 7 at most 7 < II M ||/y^|X| • |y|, 
where \\ M \\ is the operator norm (largest singular value) of M . In particular, if f : {0, 1}" x 
{0, !}"■ —>■ {0, 1} is the inner product function, then || M || = \/2" and hence 7 < l/^/2P. 

Combining this with Lemma|2J we see that a (d, 5i , 5o)-threshold embedding of the inner product 
function has 61 — 5o = 0{1/V2^). In repeated fingerprinting protocols, we then need r 2" different 
swap tests to enable the referee to reliably distinguish 0-inputs from 1-inputs! Now consider the 
following promise function, using blocks of inner product functions (IP(x,y) = Ylj ^jUj niod 2): 

Let X = . . . X™ and y = . . . y*", for m = n/ log n and x*, G {0, 1}'°S"-. 
Promise: there is a 6 G {0, 1} such that IP(x*, y*) = b for at least 2/3 of the i. 
Output: f{x,y) = b 

Clearly, < 21ogn: Alice and Bob just pick a shared random i and send and y* to 

the referee, who outputs IP(x*,y*). In contrast, / cannot be computed efficiently by a repeated 
fingerprinting protocol: for bitstrings a, 6 G {0, 1}'°S", set = a and y* = 6 for all i < m/3, and fix 
the other 2m/ 3 (x*, y*)-blocks such that half of them have inner product and the other half has 
inner product 1. Then /(x,y) = IP(a,6). Since any repeated fingerprinting protocol needs about 
n qubits to compute IP on logn qubits, the same lower bound applies to our promise function 
/. This shows that Yao's exponential simulation of public-coin protocols by repeated fingerprint- 
ing protocols cannot be improved much without going outside the fingerprinting framework. We 
actually conjecture that all quantum SMP protocols need 0,{y/n) qubits for this function. 

In general, the preceding arguments show that we can't have an efficient repeated fingerprinting 
protocol if / cannot be realized with large margin. If the largest achievable margin is 7, the protocol 
will need i7(l/7^) copies of \ax) and \f3y)- If all rows or all columns of the matrix M are distinct, 
then we know that \ax) and \f3y) need r2(logn) qubits, which gives an r2(log(n)/7^) lower bound. 
We now show that this lower bound is essentially optimal. Consider a realization of / with maximal 
margin 7. Its vectors may have very high dimension, but nearly the same margin can be achieved 
via a random projection to fairly low dimension Section 5, Lemma 2]: 

Lemma 3 (FKLMSS) A d-dimensional realization of f with margin 7 can be converted into an 
0{{n/^)'^)- dimensional realization of f with margin 7/2. 

Using LemmaEl this gives us a (d, 5i, 5o)-threshold embedding of / with d = 0((n/7)^), 5q = 
(1 — 7/2)^/4 and 5i = (1 + 7/2)^/4. Note that 5i — 5o = 7/2. This translates directly into a repeated 
fingerprinting protocol with states \ax) and \l3y) of d dimensions, hence 0(log(n/7)) qubits, and 
r = 0(1/7^). For example, if / is equality then 7 is constant, which implies an 0(logn)-qubit 
repeated fingerprinting protocol for equality (of course, we already had one with r = 1). In sum: 

Theorem ^ For f : X xY ^ {0,1}, define the \X\ x \Y\-matrix M by M^y = (-l)/(^'2'), and 
let 7 denote the largest margin among all realizations of M . There exists a repeated fingerprinting 
protocol for f that uses r = 0(1/7^) copies of 0{log{n/^))-qubit states. Conversely, every repeated 
fingerprinting protocol for f needs 17(1/7^) copies of its \ax) and \ f3y) states. 
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5 An Improved Exponential Upper Bound 



We now describe a way to simulate a given classical public-coin protocol for a Boolean function / 
by means of a quantum fingerprinting scheme. We assume for simplicity that all Alice's messages 
are c bits (our simulation actually gets better if one party's messages are shorter than the other's). 
While Yao's simulation from [231 took 0{2'^^{c + logn)) qubits, ours takes 0(2^'^(c + logn)) and 
is arguably a bit simpler as well. We may assume that the protocol uses only logn + 0(1) bits of 
randomness, i.e., n' = 0{n) possible random strings r, each equally likely, and that the referee is 
deterministic 39,,. Let arx be the c-bit message that Alice sends with random string r and input 
X, and similarly h^y for Bob's c-bit messages. Let R{a, h) G {0, 1} denote the referee's output given 
messages a and b. Then the acceptance probability of the protocol on input x and y is 



P{X, y) = ^ XI ^(^rx, bry). 



This differs from f{x, y) by at most e = 1/3. We will derive a reasonably good threshold embedding 
from this. For A^y = {a : R{a, bry) = 1}, define 



^Xk)|a,,) and 1/?^,) = _ ^ |r) | — g \a) + ^ _J:^|dummy) J , 



where 'dummy' is some extra dimension. These states live in dimension d = n'{2^ + 1) The crucial 
observation is the following bound on 5o and 6i: 



<^ if/(x,y) = 



The 0(2^'^(c -|- logn)) simulation follows immediately by repeated fingerprinting. 

Remark: Yao's simulation can be extended to work for relational problems as well, with some 
extra overhead. Consider a classical public-coin protocol with c-bit messages. With "[•]" denoting 
the truth value of a statement, the inner product of the states |r) | [arx = a]) and J2r I'') 1^" i^^y = 
b]) equals the probability that the referee receives messages a, b in the classical public-coin protocol. 
Hence given 2'^^'^^ copies of these states, for all a, b, we can simultaneously estimate all these 
probabilities up to additive error 1/(100 • 2^*^). This enables the quantum referee to simulate the 
classical referee's behavior with small error probability. Also zero-error properties can be preserved. 
Due to this observation, Q"(-P) = 0,(^/n) implies a tight classical bound i?!l'^"^(P) = Q{logn). 

6 The Hamming Distance Problem 
6.1 Upper bounds 

As an example of his simulation, Yao considered the following Hamming distance problem: 
HAMn'^^(a;, y) = 1 iff the Hamming distance between x and y is A{x,y) < d. 
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For d = 0, this is just the equahty problem. Yao showed ^"'^"^(HAMn'^^) = 0{d?) (actually, a 
better classical protocol may be derived from the earlier paper 0). This implies Qll(HAM^f)) = 
20{d?)^^ _j_ logn), hence for constant d the problem can be solved with O(logn) qubits. 

The third open problem of his paper asks for better upper bounds for this problem, both 
quantum and classical. We give two different quantum SMP protocols that are more efficient 
than Yao's. The first costs O(d^logn) qubits, and is similar to a protocol found independently 
by Chakrabarti and Regev [7j- It derives a threshold embedding directly from Yao's classical 
construction in |23| Section 4]. There, the length of the messages sent by the parties is m = 0(d^). 
The referee accepts only if the Hamming distance between the messages is below a certain threshold 
t = Q{m). Let Crx be Alice's message on random string r and input x, a^xi be the i-th. bit of this 
message, and similarly for Bob. Again we may assume r ranges over a set of size n' = 0{n) |19j . 
Yao shows that for uniformly random r and i, Pilorxi = ^ryi 

] < t/m- e{l/d) if A{x,y) < d, 
and Fic[arxi = Kyi] > t/m + Q{l/d) if A{x,y) > d. Here t/m = 0(1). Now define the following 
(log(n') + 21og(d) + l)-qubit states: 

l"x) = ^=Vk) V \i)\arxi) and = ^= V |r) V \i)\bryi)- 

Then ^ 

r l<i<m 

This threshold embedding implies an 0{d^ logn)-qubit repeated quantum fingerprinting protocol. 

Our second protocol is not of the repeated fingerprinting type, though it uses fingerprints as a 
tool. It has complexity 0(d(logn)^). This is much cheaper than Yao's protocol for d ^ \/log log n. 
The idea is the following. For every x, there are only D = Yli=o iT) different y for which the function 
evaluates to 1 (the Hamming ball of radius d around x). We let Alice and Bob send 0{logD) copies 
of the fingerprints of x and y, respectively, to the referee. We assume these fingerprints are derived 
from a linear constant-distance error-correcting code E : {0, 1}" {0, 1}™, m = 0{n), as 



^ m 



.E{x)i 



m 

1=1 



This enables the referee to test whether x = y with error probability <^ but also to make 

D different equality tests such that with high probability these tests all succeed simultaneously 
(test unitarily, copy the answer, and reverse to get almost the original state back). The referee 
can change the j'-th bit of the fingerprinted string, i.e., map ^ \<Pxi) using the unitary map 
\i) I— > (— l)^(^j)' since E{x^) = E{x) © E{ej) by linearity. Hence he can just try out all D 
possibilities around x and test whether y equals any one of those D strings. This suffices to 
compute }lAM^\x,y) at a cost of 0{logD ■ logn) = 0(d(logn)^) qubits (and O(logn) for d = 0). 

The same idea gives a classical public-coin SMP protocol that uses O(log-D) = 0{dlogn) bits 
of communication (do the usual classical protocol for equality with error reduced to <C 1/-D). For 
d ^> logn, this is better than Yao's 0(d^)-bit protocol. 

6.2 Lower bounds 

Here we show that the above protocols are close to optimal, by proving an i}(d) lower bound on 
all 1-way quantum protocols for HAM^*^^ (1-way protocols are 2-party protocols where Alice sends 
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one message to Bob, who computes the output). Consider a protocol where Ahce sends a g-qubit 
message px to Bob, who then outputs ^AM^n\x,y) with probabihty > 2/3. We will show that the 
messages actually induce a quantum random access code for the set of d-bit strings jl8j . A random 
access code of a d-bit string z allows its user to recover each bit zi with probability at least 2/3. 
Invoking Nayak's (1 — H(2/3))d lower bound on the length of such encodings then finishes off the 
proof (here H{-) is the binary entropy function). 

Suppose Alice has a d-bit string z. She defines x = zO"^"', and sends to Bob the Hamming 
weight 1^1 and the quantum message px- The total communication is logd classical bits and q 
qubits. Bob looks at the \z\ that he received, and defines y = Q^i<^+'^-\^\Q''^^'^d.~i+\z\ ^ where Cj is the 
d-bit string that has a 1 only at position i. Then Bob completes the protocol for x and y. We have: 

= 1 iff A(x, y) = d 
= iff A(x,y) = d+l 

This gives Bob the bit Zj, with probability 2/3, for any i G [d\ of his choice. Accordingly, the pair 
(|z|, Pa;) forms a random access code for z, and Nayak's bound implies log(d) + g > (1 — H{2/3))d. 
The same lower bound, with a loss of a factor of 2, also applies to the model where Alice and Bob 
start out with an unlimited amount of entanglement (such as shared EPR pairs) ^XM- Hence: 

Theorem 4 Every quantum 1-way communication protocol for needs 0,{d) qubits of com- 

munication (even with unlimited prior entanglement). 

This bound also holds for weaker models, such as all SMP models discussed in this paper, 
including the public-coin ones. With private coin, it is also easy to show an Q{logn) bound via a 
reduction from equality. We summarize our quantum SMP upper and lower bounds: 

Theorem 5 17(d + logn) < Q^HAm'^'^) < 0(dlognmin(d,logn)). 

7 Summary and Open Problems 

In this paper we have shed some new light on the power of quantum simultaneous message passing 
protocols, in particular in comparison to classical public-coin protocols. Our main result is 

• A relational problem where quantum SMP protocols need exponentially more communication 
than classical public-coin ones. This gives the first exponential separation between the two 
models, and shows that the resource of public randomness cannot be traded efficiently for 
quantum communication. 

In addition we proved 

• A characterization of the optimal quantum fingerprinting scheme in terms of the best margin 
achievable by arrangements of homogeneous halfspaces. 

• Every classical c-bit public-coin protocol can be simulated by a quantum SMP protocol using 
0(2^'^(c + logn)) qubits of communication, which is a quadratic improvement over |23j . 

• We constructed better quantum SMP protocols for the Hamming distance problem, and 
showed that these are close to optimal. 

The main problem left open by this paper is to modify our separation to work for a Boolean 
function, for instance the one from Section^ And, of course, we would like to find more quantum 
protocols beating their classical counterparts in some way or other. 
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